Bug 217446

Summary:	REGRESSION: ASSERTION FAILED: verticalGap >= 0 in WebCore::Layout::InlineFormattingState::setClearGapAfterLastLine
Product:	WebKit	Reporter:	Ryan Haddad <ryanhaddad>
Component:	Layout and Rendering	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	bfulgham, simon.fraser, webkit-bug-importer, zalan
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Ryan Haddad

Reported 2020-10-07 14:08:24 PDT

ASSERTION FAILED: verticalGap >= 0 ./layout/inlineformatting/InlineFormattingState.h(84) : void WebCore::Layout::InlineFormattingState::setClearGapAfterLastLine(WebCore::InlineLayoutUnit) 1 0x13d3de099 WTFCrash 2 0x11d21c87b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x120c41c70 WebCore::Layout::InlineFormattingState::setClearGapAfterLastLine(float) 4 0x120c4128b WebCore::Layout::InlineFormattingContext::lineLayout(WTF::Vector<WebCore::Layout::InlineItem, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::Layout::LineBuilder::InlineItemRange, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 5 0x120c40084 WebCore::Layout::InlineFormattingContext::layoutInFlowContent(WebCore::Layout::InvalidationState&, WebCore::Layout::FormattingContext::ConstraintsForInFlowContent const&) 6 0x120c69173 WebCore::LayoutIntegration::LineLayout::layout() 7 0x121856d19 WebCore::RenderBlockFlow::layoutLFCLines(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 8 0x121854498 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 9 0x121853549 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 10 0x1218363c9 WebCore::RenderBlock::layout() 11 0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 12 0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 13 0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 14 0x1218363c9 WebCore::RenderBlock::layout() 15 0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 16 0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 17 0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 18 0x1218363c9 WebCore::RenderBlock::layout() 19 0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 20 0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 21 0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 22 0x1218363c9 WebCore::RenderBlock::layout() 23 0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 24 0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 25 0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 26 0x1218363c9 WebCore::RenderBlock::layout() 27 0x1218561c2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 28 0x121854784 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 29 0x121853566 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 30 0x1218363c9 WebCore::RenderBlock::layout() 31 0x121b096a3 WebCore::RenderView::layout() LEAK: 2 WebPageProxy

Attachments
Add attachment proposed patch, testcase, etc.

Ryan Haddad

Comment 1 2020-10-07 14:09:20 PDT

Saw the assertion above on Catalina Debug WK2 with the following tests: accessibility/content-changed-notification-causes-crash.html fast/block/float/float-append-child-crash.html fast/css/simple-layout-overflow.html fast/shapes/shape-outside-floats/shape-outside-negative-line-height-crash.html imported/blink/fast/borders/border-box-overflow-crash.html https://build.webkit.org/results/Apple-Catalina-Debug-WK2-Tests/r268135%20(7082)/results.html

alan

Comment 2 2020-10-07 14:09:25 PDT

fixed in https://trac.webkit.org/changeset/268150/webkit

Radar WebKit Bug Importer

Comment 3 2020-10-07 14:10:16 PDT

<rdar://problem/70064317>

Note You need to log in before you can comment on or make changes to this bug.